Version 2022-01-21 -- Contact author at eisvogel at embinet dot de
Or leave a comment at https://aur.archlinux.org/packages/bareos-common/

A few words of explanation...

- RAID is not a backup. ;-)

- Backups should be done "3-2-1": Have at least 3 data copies, on 2
  different technologies, 1 offsite. Tape backup may sound antiquated, but
  it will provide you with one for every of the 3-2-1 items. In addition,
  LTO tape when stored vertically in a dry, cool, dark place is rated for
  30 years of data integrity. No HDD, SSD or USB thumb drive will even
  come close. DVD and Blu-ray media when written at lowest speed possible
  are better, but have been stuck at low capacities of only 5-50 GiB for
  a decade. In addition, while LTO-6 tapes can be rewritten 150 times or
  more, disc media are usually of type WORM, write once read many.

- The hardware employed in the examples consists of two external LTO-tape
  drives, one LTO-5 and one LTO-6, all connected to one Linux machine.

- The machine also has the ZFS pools which need to be backed up. Therefore
  all three daemons bareos-(dir|fd|sd) are also running on the machine.

- IBM-type external enclosures will not turn on when power is (re-)applied.
  Ordinarily it requires a person or trained cat to push the power button
  when power was out. These are also not silent devices, because chips in
  the drives produce a good amount of heat during operation, which need
  to be cooled. To cut down on noise and also fix the power-on problem,
  both IBM-type drives were modified to include a 3-pin 2.5mm headphone
  socket on a back slot, next to the network interface. The tip and middle
  signal of the socket is routed potential-free within the drive to the
  two free pins of the power switch. A USB relais box (KMtronic U2CR) is
  connected to each drive on pin C+NO and also via USB to the machine. The
  script "tape-helper" is used to find the USB box and to briefly toggle
  the relais in order to turn on/off a specified drive. Operation of the
  power button is unaffected.

- Every day at 18:00, an incremental backup is run on LTO-5, which in this
  case writes to LTO-4 tapes. On the 1st Monday of each quarter, a full
  backup is written to LTO-6 tapes.

- The selected Maximum Block Size (1MB) and Maximum File Size (20GB) should
  provide optimal speed up to LTO-6 (168 MByte/s, large files from an SSD,
  half-height drive). LTO-7 and beyond could be optimal still, untested.

- Before backup, a ZFS snapshot called <pool>@bareos is created. It is
  deleted when no longer necessary. This requires
  "zfs allow -u bareos mount,snapshot,destroy <pool>"
  to be run once as root, to allow the bareos user to create and delete
  snapshots.

- After each incremental/full backup run, a second full backup job called
  "Backup-DR" is run (DR = Disaster Recovery), which saves the main SQL
  database and configuration files also to tape. In case of a full loss of
  the server, this will come in handy when needing to restore everything.
  The only pain will be to retrieve the very last DR backup without the
  help of the database. With these data in hand, Bareos can then be
  reinstalled swiftly, giving back access to the full backup history for
  further restoration of files.

- In our example tapes will be ejected automatically when the server wants
  a different one. The server will also beep, Backup Exec(tm) 11d style.

- TLS is disabled, because these examples is only ever about localhost.

- To compress a SQL dump lbzip2 is recommended, because everyone has bzip2
  to decompress, it uses all available CPU cores, is fast, ratio is good.

- Make sure you read any scripts you want to use from start to finish, as
  some will need further configuration. E.g. tape-helper to mail cleaning
  tape advisories by e-mail or define devices. Script examples included:

    * read_attribute.pl: parses binary MAM data into human-readable output.
      Should probably be rewritten in C. I made it work with recent Perl
      versions from older versions found on the web.

    * tape-label: Needs configuration in the file. Argument will be tape
      name. Loads tape, writes EOF to start to delete any records, rewinds,
      labels in Bareos, ejects tape again.

    * tape-operator: Beep, unmount, eject tape when Bareos wants a new tape.
      Used in bareos-dir.conf Messages resource as "operatorcommand". Needs
      correct storage name as first argument to know what to eject and then
      the usual bstmp command following.

    * tape-helper: Needs in-script configuration. As such probably only
      useful in my system, but just to give anyone interested an idea what
      can be done feature-wise. Like ZFS snapshots, USB-control, send
      e-mail in case drive wants a cleaning tape, read MAM chip of
      cartridge and send to read_attribute.pl etc.

    * tape-watch: Print stats about active clients every ten seconds.

    * pwg: Generate strong passwords using pwgen, print estimated strength.

- To allow non-root users like bareos to beep through a PC speaker, e.g.
  from within the tape-operator script, the following steps are necessary:

    * Create a system group called beep and add user bareos to this group:
        groupadd -r beep
        usermod -a -G beep bareos

    * Create file /etc/udev/rules.d/99-bareos.rules with the line:
        ACTION=="add", SUBSYSTEM=="input", ATTRS{name}=="PC Speaker", ENV{DEVNAME}!="", RUN+="/usr/bin/setfacl -m g:wheel:w -m g:beep:w '$env{DEVNAME}'"

TODO

- Automated regular restore test, because "An untested backup is just whishful thinking."
- Rewrite read_attribute.pl in C
- Fix PHP bugs
  * Undefined offset: 0 in /usr/lib/bareos/webui/module/Job/src/Job/Model/JobModel.php on line 381
    Trying to access array offset on value of type null in /usr/lib/bareos/webui/module/Job/src/Job/Model/JobModel.php on line 381
  * Undefined index: value in /usr/lib/bareos/webui/module/Pool/src/Pool/Model/PoolModel.php on line 152